jmsperu commented on PR #12898: URL: https://github.com/apache/cloudstack/pull/12898#issuecomment-5452726691
Rebased onto current 4.22 (merge `7f2c57ab1a`) — this is mergeable again. Two files conflicted, both from the recent command-injection hardening on 4.22: - **`LibvirtRestoreBackupCommandWrapper`** — 4.22 reordered the imports and dropped the shell-string constants (`MOUNT_COMMAND`, `UMOUNT_COMMAND`, `ATTACH_*`, `CURRRENT_DEVICE`, `RSYNC_COMMAND`) in favour of argv-array `Script.executeCommand(...)`. I took 4.22's structure wholesale and re-applied the LUKS work on top, so the non-encrypted path is now upstream's hardened `rsync` argv form and only the encrypted path builds a `qemu-img convert`. The one constant this PR still needs, `LUKS_SECRET_ID`, is kept. - **`LibvirtRestoreBackupCommandWrapperTest`** — import-ordering only. No behaviour from either side was dropped: the hardening applies to the plain path, the decrypt-on-restore applies to the encrypted path, and they do not overlap. Verified locally on JDK17: - `LibvirtRestoreBackupCommandWrapperTest` + `LibvirtTakeBackupCommandWrapperTest` — **18/18 pass** - `NASBackupProviderTest` — **15/15 pass** - `bash -n nasbackup.sh` clean Ready for `@blueorangutan package` / `test` whenever a committer can approve-and-run. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
